sslsplit: Certificate error: loading src server certificate failed

This is very similar to #246. I’m running Kali 2019.1 with SSLsplit 0.5.4 and see the “loading src server certificate failed” error… I tested the same commands using SSLsplit 0.5.2 and everything works fine.

Below are the commands that I used to set up the server, client and SSLsplit. The failing output from the server, client and SSLsplit are attached.

Server

The default options were used for the openssl req command.

openssl genrsa -out server.key 2048
openssl req -new -key server.key -out server.csr
openssl x509 -req -in server.csr -signkey server.key -out server_signed_cert.pem
openssl s_server -accept 9999 -key server.key -cert server_signed_cert.pem -debug

SSLsplit

The default options were used for the openssl req command.

openssl genrsa -out fake.key 2048
openssl req -new -key fake.key -out fake.csr
openssl x509 -req -in fake.csr -signkey fake.key -out fake_signed_cert.pem
sslsplit -D -c fake_signed_cert.pem -k fake.key ssl 0.0.0.0 8888 192.168.128.129 9999

Connections

Initial connection directly to server to prove the server/client works fine: openssl s_client -connect 192.168.128.129:9999

Follow up connection via SSLsplit: openssl s_client -connect 192.168.128.134:8888

openssl-client-trace.txt openssl-server-trace.txt sslsplit-trace.txt

About this issue

  • Original URL
  • State: closed
  • Created 5 years ago
  • Comments: 23 (2 by maintainers)

Commits related to this issue

Most upvoted comments

It turns out that this issue is not related to OpenSSL, but Debian! Please read the explanation of Debian Security Level Update here. So, as explained there, you can fix this issue by changing the last section in /etc/ssl/openssl.cnf to something like (which drops the security level from 2 to 1):

[system_default_sect]
MinProtocol = TLSv1.2
CipherString = DEFAULT@SECLEVEL=1

So I should modify the rsa-key-size branch based on this finding.